Re: [PATCH 1/2] KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU

[Huang, Kai]

On Mon, 2026-07-27 at 17:22 -0700, Sean Christopherson wrote:
> Use LOCK CMPXCHG instead of LOCK AND to clear the Accessed bit when aging
> SPTEs in the TDP MMU, as doing a LOCK AND can corrupt a FROZEN SPTE and
> allow a third CPU to effectively overwrite the FROZEN SPTE.  As pointed
> out by AI of some kind, because the magic FROZEN_SPTE value is a "full"
> SPTE, not a single bit, and includes the Accessed bit, clearing the
> Accessed bit in a FROZEN SPTE will result in is_frozen_spte() getting a
> false negative.
> 
> E.g. if CPU0 freezes an SPTE, and CPU1 clears the Accessed bitin the frozen
							     ^
							     bit in

> SPTE, then CPU2 could come along and overwrite the frozen SPTE with a
> shadow-present SPTE.
> 
> Thankfully, the false negative is largely benign, because outside of TDX,
> which doesn't support aging, KVM only freezes leaf SPTEs when removing an
> upper level shadow page.  So while KVM could clobber a frozen SPTE back to
> a shadow-present SPTE, and could even use the new SPTE, the subsequent TLB
> flush will make the orphaned, shadow-present SPTE unreachable.  Failure to
> ever zap the orphaned leaf SPTE would show up in KVM's stats, but otherwise
> is benign (because KVM no longer keeps an elevated refcount for leaf SPTEs).
> 
> Opportunistically add a comment to warn future developers away from using
> kvm_tdp_mmu_write_spte_atomic() and tdp_mmu_clear_spte_bits_atomic(), as
> they are generally unsafe.  Keep the helpers, e.g. instead of open-coding
> the atomic64_fetch_and() in tdp_mmu_clear_spte_bits(), as scary warnings
> usually are more effective deterrent against recidivism than removal of the
> dangerous code.
> 
> Alternatively, KVM could use different bits for the magic FROZEN_SPTE value,
> e.g. setting the Dirty bits (with effective IPAT and Global aliases) would
> likely be "ok", as IPAT/Global are extremely unlikely to be cleared without
> doing a full SPTE write, and KVM's clearing of Dirty bits shares logic with
> Write-Protection, which must do a full SPTE write (via cmpxchg64() in the
> TDP MMU) to ensure KVM isn't clobbering state.  But there is zero reason to
> carry that risk (beyond stubbornness in wanting to preserve a "cute" idea),
> as the cost of LOCK CMPXCHG and LOCK AND are within 1-2 uops of each other
> on modern hardware.
> 
> Fixes: b146a9b34aed ("KVM: x86/mmu: Age TDP MMU SPTEs without holding mmu_lock")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> 

Reviewed-by: Kai Huang <kai.huang@xxxxxxxxx>